Behind the scenes in the Expel SOC: Alert-to-fix in AWS

Over the July 4th weekend Expel’s SOC detected that a compromised AWS root access key was used to create SSH key pairs, spin up ten c5.4xlarge EC2 instances, and connect to a Monero mining pool; the team used CloudTrail and GuardDuty signals plus automated tooling to triage, escalate to the Global Response Team, and contain the incident within 37 minutes by removing the stolen key, terminating instances, and deleting malicious security groups.